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FOREWORD 


The authors wish to acknowledge the efforts of Mr. Norman R. 
Schulze, Code Q, NASA Headquarters, who provided the impetus 
and funding for this manual. Mr. Morry L. Schimmel, the 
coauthor of this paper, had a distinguished career with 
McDonnell Douglas until 1984 and provided consultantion to 
Langley Research Center until his death in 1995. Mr. E. R. 
Lake, Ray Lake Company, St. Louis, Missouri, contributed to 
Chapter 5, Initiation Systems/ Initiators. This manual has 
provided the text for a 2 -day short course taught in 
conjunction with the American Institute of Aeronautics and 
Astronautics (AIAA) . 
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Chapter 1.- INTRODUCTION 

ft 

Although pyrotechnic devices have been singularly responsible 
for the success of many of the critical mechanical functions 
in aerospace programs for over 30 years, ground and in-flight 
failures continue to occur. Subsequent investigations reveal 
that little or no quantitative information is available on 
measuring the effects on performance of system variables or 
on determining functional margins. The three following 
examples amplify these points. A pin puller design, that was 
used for the successful deployment of an antenna on the 
surface of Mars in 1976 in the Viking Lander Program, failed 
to function in a second application in 1986 and was 
abandoned. A spacecraft separation joint failed to function 
in a 1984 ground test after more than 20 years of flight 
successes; the same joint, which is designed for full 
containment of explosive products, burst in 1994 during 
release of a payload from the Space Shuttle cargo bay. A 
"fully qualified" valve design, that was created for the 
Gemini Program in the early 1960's, structurally failed and 
ignited hydrazine in 1994 through previously unrecognized 
failure modes. Improved guidelines for pyrotechnic design, 
development and qualification are clearly needed. 

The purpose of this manual is to provide an overview of and 
recommendations for the design, development and qualification 
of pyrotechnic components and the systems in which they are 
used. This is a complex field in which there are few 
specialists and even fewer guidelines on the approach to 
create a device and assure it will perform its required task. 
The field of pyrotechnics is generally considered to be an 
art, not a science or engineering discipline. Also, 
pyrotechnics are considered to be readily available, and, 
therefore, can be managed by any subsystem in which they are 
applied, such as structure, propulsion, electric power or 
life support. This presentation is intended to dispel these 
misconceptions . 

The objectives of this manual are: 

1. Remove the art from pyrotechnic applications. 

2. Introduce engineering approaches. 

3. Provide the logic for improved procurement, design, 
development, qualification, integration and use. 

Tests methods and logic are recommended that quantify 
performance to improve widely cited go/ no-go testing of under 
and over-loaded energy sources. References are noted 
throughout to allow the reader to obtain more detailed 
information on all test methods. 

This manual does not provide "cookbook" answers and 
approaches for any aspect of pyrotechnic operations. Not 
only are devices unique, requiring individualized approaches 
for design, development and qualification, but systems and 
operational procedures are also specialized. The contents of 
this manual are not intended for direct incorporation into 
pyrotechnic specifications. 
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Chapter 2.- PYROTECHNICS DEFINITION, CONSIDERATIONS FOR 
APPLICATIONS 

2-1 Definition of Pyrotechnics 

In aerospace technology pyrotechnics refer to a broad family 
of sophisticated devices utilizing explosive, propellant and 
pyrotechnic compositions to accomplish: 

* initiation * release * severance/ fracture 

* jettison * valving * switching 

* time delay * actuation 


Reference 1 


The first use of the term "pyrotechnics" for explosive and 
propellant-actuated devices m the aerospace field was by 
Harry Lutz of McDonnell Aircraft Company during the Mercury 
program. In response to a concern voiced by program 
management about using explosive devices in close proximity 
to the astronaut, Harry said, "Don't call them explosives, 
call them pyrotechnics." This was quickly shortened to 
"pyros," which sounded even less threatening. 


2-2 Pyrotechnics Are Extensively Applied Because of Their 
High Efficiency 

o High energy delivered per unit weight 
o Small volume, compact 
o Long-term storable energy 

o Controllable initiation and output energies 

Reference 1 


Few sources of energy combine all four of these attributes. 
Pyrotechnics contain the needed energy to accomplish a 
desired function within small volumes. The only external 
energy required is an initiation input. Initiation inputs to 
devices (mechanical, electrical, pneumatic, explosive 
transfer or laser) can be precisely established to prevent 
inadvertent initiation, as well as to assure adequate 
initiation energy. Pyrotechnics utilize solid material 
compositions that are highly energetic and can be selected to 
be stable under extremes of both thermal and vacuum 
conditions. 


2 



2-3 Although Succe ssfu l, Py r otec h ni cs Aye Reluctantl y Used 


o Unique Characteristics 

- Single shot 

- Cannot be functionally checked before flight 

- Short-duration, impulsive loads (pyrotechnic 
shock) 

- Safety issues 

* Contain explosive materials 

* Inadvertent functioning: 

+ only small forces sometimes required to 
initiate 

+ static electricity 
+ lightning 

+ electromagnetically induced energy 
+ stray energy in firing circuits 

o Limited engineering approaches/ standards are available 
for pyrotechnic applications 

- Cannot apply approaches for commonly used energy 
sources (electric, hydraulic, pneumatic) 

- Lack of test methods and logic to demonstrate 
functional margin 

- Go/no-go testing 

o Failures continue to occur 

- Lack of understanding of mechanisms 

- Poor or no resolution of failures 

- Few sources for information (reliance on 
manuf actur er s ) 

- Reliability estimate based on successful 
qualification 

References 1, 2, 3 and 4 


Clearly, the advantages of using pyrotechnics often outweigh 
this burdensome list of disadvantages, concerns and 
challenges, or there would be no applications. In the early 
stages of the Shuttle program, an edict was made that there 
will be no pyrotechnics used for the vehicle or for payloads. 
Pyrotechnics violate one of their first ground rules, which 
is that systems shall be reusable. However, over 400 
pyrotechnic components fly on each Shuttle mission with some 
used on each flight and others only for emergencies. A 
primary requirement for Shuttle payload pyrotechnics is the 
assurance that on functioning, the Shuttle will not be 
damaged . 

Pyrotechnics normally are used only once, since often 
internal structural deformation is incurred in each firing. 
These devices cannot be cycled like solenoid-actuated 
switches to assure their functionality. The best assurance 
of successful operation is that the devices are designed with 
functional margins and have been accurately manufactured. 

The explosive, propellant and pyrotechnic-composition energy 
sources will burn completely and quickly no matter if the 
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ignition input is intentional or inadvertent. Selecting low- 
level energy inputs to ignite these materials is a weight 
advantage, but can be a safety hazard. 

There are few guidelines for the design and application of 
pyrotechnic devices. There is a lack of accepted test 
standards to evaluate functional performance of devices. 
Existing methods generally rely on go/no-go testing, which 
means that a device either does or does not work. 

No college courses are offered for this sophisticated 
aerospace field, and past experience in other energy sources 
cannot be applied, primarily due to the single-shot, dynamic 
nature of pyrotechnic devices. Consequently, mission- 
critical functions are sometimes entrusted to pyrotechnic 
devices with less than the required reliability. The lack of 
understanding of these devices can lead to failures, as well 
as inadequate failure resolution. Since there are few 
sources of information, users are forced into a reliance on 
manufacturers. In using "off-the-shelf" hardware, component 
functional and system evaluation is often minimized with the 
assumption that qualification exists. Furthermore, 
manufacturers may have a different view of success than does 
the user. Should a failure occur, there is a conflict 
between finding out the exact cause and getting on with the 
program schedule . 

Statistical reliability and confidence is usually based on 
information compiled by the manufacturer in functional 
evaluations on any particular device and on its predecessor 
designs. To achieve a statistical basis for a 99.9% 
reliability with a 95% confidence level, more than 2000 
identical devices would have to be evaluated. Such a number 
is often cost prohibitive. 


4 



Chapter 3.- PYROTECHNIC FUNCTIONAL PRINCIPLES 

o Majority of pyrotechnically actuated functions 
accomplished through piston/cylinder devices 

o Other functions accomplished by linear explosives 

o Figures 1 through 14 show basic principles 

o Tables I and II show past applications 

References l, 5, 6, 7, 8 and 9 


Before Actuation After Actuation 


THRUSTER 



RETRACTOR OR 
PIN PULLER 




Figure 1. Cross sectional views of pyrotechnically actuated 
linear actuators, describing function. 
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Figure 2. Cross sectional views of pyrotechnically actuated 
valves, describing function. 



Figure 3. Cross sectional views of pyrotechnically actuated 
separation nuts, describing function. 
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FRAGMENTING (STRUCTURAL BREAKUP) PRESSURE (TENSION FAILURE) 



Figure 4. Cross sectional views of explosive and 

pyrotechnically actuated separation bolts, 
describing function. 




EXPLOSIVE ACTUATED 


Figure 5. Cross sectional views of pyrotechnically actuated 
cutters or guillotines. 
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Figure 6. Cross sectional views of mild detonating cord 

(MDC) -actuated severance and separation approaches 



FLEXIBLE LINEAR SHAPED CHARGE (FLSC) f-C . \ 



Figure 7. Cross sectional views of flexible linear shaped 
charge (FLSC) severance. 



TABLE I.- Major Past and Current Pyrotechnic Applications 
in Aeronautics 


PROGRAM 

NUMBER OF 
AIRCRAFT INSTALLED 
PYROTECHNIC DEVICES USED 

F-4 (DUAL PLACE) 
(EXCLUDING ARMAMENT 
REQUIREMENTS) 

31 

F-111 CREW MODULE 

315 

F-14 (DUAL PLACE) 
(EXCLUDING ARMAMENT 
REQUIREMENTS) 

211 

F-15 (SINGLE PLACE) 
(EXCLUDING ARMAMENT 
REQUIREMENTS) 

44 

F-4 ARMAMENT 
CARTRIDGE REQUIREMENTS 
FOR A MISSION CONFIGURATION 
OF (24) 500 LB BOMBS AND 4 
SPARROW MISSILES 

42 


TABLE II.- Major Past and Current Pyrotechnic Applications 
in Astronautics 


PROGRAM 

NUMBER OF SPACECRAFT 
INSTALLED PYROTECHNIC 
DEVICES USED 

MERCURY 

46 

GEMINI 

139 

SATURN 

APPROX. 

150 

APOLLO 

314 

(CSM/SLA/LM) 

APOLLO 


(CSM/SLA) 

249 

FOR SKYLAB 
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Figure 11. Depiction of pyrotechnic devices used on Project 
Gemini. 


11 




























Figure 12. Depiction of pyrotechnic devices used on the 

Command Module and escape system, Project Apollo. 



Figure 13. Depiction of pyrotechnic devices used on the Lunar 
Excursion Module, Project Apollo. 
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Figure 14. Shuttle Transportation System pyrotechnics. 
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Chapter 4.- PYROTECHNIC, PROPELLANT AND EXPLOSIVE MATERIALS 
AS ENERGY SOURCES 

o Energy delivery affected by burn rate 

- Time delay trains (pyrotechnic mixes) : inches/second 

- Double-base propellant: inches/second 

- Metal/metal oxides: hundreds of feet/second 

- Primary explosives: less than 10,000 feet/second 

- Secondary explosives: over 20,000 feet/second 

o Wide range of energy characteristics 

- Energy delivered in various forms: heat, light, gas 

- Minimal to intense heat production 

- Gas evolution: gasless to millions of psi 

- Time to peak pressure less than microsecond to 
seconds 

o Combustion affected by: 

- Density and particle size of burning material 

- Initial free volume 

- Confinement 

- Shape of the volume 

- Heat transfer characteristics 

- Changing volume (stroking piston) 

o Energy delivery can be tailored to meet a very wide 
range of performance by adjusting the above parameters 

Reference 4 


The primary influence of energy deliverable by pyrotechnics, 
propellants and explosive is burn rate. As the burn rate 
changes, so do the products of the combustion. The forms of 
energy delivered are heat, gas and light, depending on the 
material or combination selected. Pyrotechnic compositions 
produce intense heat and often intense light with very little 
gas production. Propellants are used to deliver high- 
pressure volumes of gas, often with only moderate heat. 
Primary explosives rapidly (microseconds) develop hundreds of 
thousands of psi of gas pressure, while high explosives 
develop millions of psi m even a shorter time frame, with 
very little heat production. 

The combustion of these materials is affected by a number of 
parameters. Compacted small particles will burn faster than 
larger particle sizes at the same density. Of course, with 
loose-particle combustion, the larger the surface area, the 
more rapid the combustion. Gas producing materials are 
generally affected by ambient pressure; the higher the 
ambient pressure, the faster the burn rate. Consequently, 
propellants ignited in a large free volume must first 
pressurize the volume, before the ambient pressure is raised 
sufficiently to increase the burn rate. The shape of the 
volume in which reactions occur affect heat transfer within 
the combustible material itself, as well as transferring heat 
to surrounding structure. The greater the surface area and 
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thermal transfer properties of the container, the more heat 
loss and reduction in burn rate of the material. An 
increasing volume, such as a stroking piston reduces burn 
rate by lowering ambient pressure, as well as increasing the 
surface area exposed to the hot gas. Energy delivery 
characteristics can be tailored over a wide range by 
adjusting the above parameters. Tables III through VIII 
describe the properties of several widely used pyrotechnic, 
primary explosive and secondary explosive materials. 


TABLE II I.- Properties of a Time-Delay Mix 
fD-16. MIL-M-21383) 


o 


o 

o 

o 

o 


Formu 1 a : Ingredient 


% bv Weight 


Manganese 
Barium Chromate 
Lead Chromate 

Burn rate: 8.7 seconds/ inch 
Virtually gas less output 
Stability: Extended service life results 
in longer delay 

Application in sequencing pyrotechnic functions 


37 

20 

43 


Reference 10 


TABLE IV.- Properties of a Gas-Generating Material (Hercules 
Hi -Temp) 


o 

Formula: Ingredient 

% bv Weight 


RDX 

80 


Nitrocellulose 

20 

o 

Gas Composition: CO 

33.5 


C0 2 

15.1 


h 2 

0.8 


h 2 o 

17.2 


Sther 

32.4 

1.0 

o 

Stability: less than 1% weight loss 

in 5 hr. at 275°F 


(Source: Hercules Incorporated) 


o RDX sublimes under vacuum (shouldn’t be used for deep- 
space applications; container seal is a single-point 
failure) 

o Sensitive to ambient pressure for ignition and 
burning (higher rate at higher pressures) 
o Application as gas generating source for cartridges 
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TABLE V.- Properties of Boron/Potassium Nitrate (B/KNO 3 I 
o Gas generating material 

o Burn rate minimally affected by ambient pressure 
o High-temperature combustion, hot particles 
o Thermally stable 
o Vacuum stable 
o Long shelf life 

o Application as rocket motor igniter and gas generator 

References 11 and 12 


TABLE VI.- Properties of NASA Standard Initi ator (NSI1 Mix 

o Zirconium/potassium perchlorate (Zr/KC10 4 ) 

- Burn rate of hundreds of feet /second 

- Rapid pressure rise 

- Output = hot particles, little gas 

- Electrostatically sensitive 

- Good hotwire initiation interface 

- Thermally and vacuum stable 

- Long shelf life 

o Application as an initiator and as an energy source 

References 4 and 13 


TABLE VII ,r Properties of L ead Azide 

o Transfers from a deflagration to detonation, short 
distance (about 0.1 inch) 
o Detonation rate of about 7,000 feet/second 
o Thermally stable (except for desensitizing agents: 
dextrin) 

o Vacuum stable (except for dextrin) 
o Long shelf life 

o Sensitive to impact, friction and electrostatics 
o Application in detonators to initiate a high- 
explosive output 

References 14, 15 and 16 


TABLE V III.- Properties of Hexanitrostilbene (HNS) 

o Detonates at a propagation velocity of 22,000 
feet/second (32,000 psi compaction pressure) 
o Thermally stable 
o Vacuum stable 

o Insensitive to non-explosive stimuli 
o Application in detonators, linear explosives and 
bulk charges 

References 16, 17 and 18 
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Chapter 5.- INITIATION SYSTEMS /INITIATORS 


The basic initiation systems for aerospace systems are: 


o Electrical 
o Mechanical 
o Hot Gas 


o Explosive transfer 
o Shock tube 
o Laser 


5-1 Electrical Firing System Characteristics 

o Provide reliable electrical energy to initiator 

- Direct current 

- Capacitor discharge 

o Protect against inadvertent initiation 

- Shielding: lightning, static electricity, radio 
frequency, electromagnetically induced energy 

- Two-fault tolerant switches 

o Control /sequence firing commands 

o Provide electrical isolation from other electrical 
circuits 

o Greatest safety consideration is final connection to 
device 

- Assure no energy in circuit 

- Remove shield from device and install final 
connector 


References 19, 20 and 21 


5-1-1 Electrical Initiator Characteristics 

(na$a standard in it iato r ISIlH fi g ure _i5i 

o Convert electrical energy to heat to ignite "first- 
fire" through high-resistance bridgewire 

- Direct current 

- Capacitor discharge 

o Provide reproducible initiation characteristics 

- No-fire energy; 1-amp/ 1-watt, five minutes 

- Predictable ignition delay for recommended firing 
energy 

o Prevent inadvertent initiation 

- 1-amp/l-watt no-fire dissipation 

- Stray energy {transients, radio frequency, 
e lectr omagnet ic ) 

- Electrostatic discharge 

o Provide electrical isolation from structure 
o Provide ignition for pyrotechnics, propellants and 
explosive trains 

o Sometimes used as sole energy source for small 
mechanisms 

o Provide post-fire seal 

References 4 and 13 
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5-1-2 Exploding Bridaewire fEBW) Initiator 

o Uses low-resistance conductor (gold) bridgewire 
o Uses internal spark gap to prevent conducting low voltage 
and current levels through bridgewire 
o Uses several thousand-volt capacitor discharge firing 
system, which couples through internal spark gap 
o Bridgewire vaporizes (explodes) to provide an impulse to 
directly initiate secondary explosives 
o Eliminates the need for sensitive initiation materials 
and primary explosives 
o Provides post-fire seal 

o Major drawbacks are bulky, heavy power supplies, 
capacitors, switches and cables 


5-2 Mechanical Initiation System Characteristics 

o Provide mechanical input to initiator (primer) 

- Spring compression/release 

- Pneumatically driven 

- Impact driven 

o Provide firing pin interface to primer 
o Prevent inadvertent functioning of initiation handles 

- Two-step operation (squeeze/pull or rotate/pull) 

- Minimum force and stroke required 

o Assure adequate energy to initiate primer 

- Threshold pneumatic and impact energy 

- 2 X (50% firing energy level + 5 standard deviations) 
o Provide post-fire seal 

Reference 22 


5-2-1 Mechanical Initiator Characteristics (M42 Percussion Primer 
example) 

o Convert mechanical energy to ignite primer mix 
o Primer composition ignited by crushing/ friction between 
cup and anvil 

o Provide reproducible initiation characteristics 

- No-Fire (1.92-ounce ball drop): 

50% firing level drop height minus 2 standard 
deviations 

shall not be less than 2 inches (3.84 inch-ounces) 

- All-Fire (1.92-ounce ball drop): 

50% firing level drop height plus 5 standard deviations 
shall not exceed 13 inches (25.49 inch-ounces) 

- 50% firing level approximately 10 inch-ounces 

o Provide ignition output (heat, gas, light, burning 
particles) 

o Provide post-fire seal 

o Primers themselves not sealed; must be sealed by assembly 
into which it is installed 

Figure 16 shows percussion primer designs. 

Reference 22 
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5 -2 -2 .. S tafr Primer 


o Used where full containment not necessary 
o Sharp firing pin penetrates through cup 
o Achieves ignition by fracture/ friction of primer 
composition 

o Input energy generally less than needed for 
percussion primer 

o Output comparable to percussion primer 

The Separation Plane Initiator Assembly (figure 17) has a 
number of valuable design features to assure operational 
safety and reliability. The "remove before flight" Pip Pin 
prevents any motion of the Firing Pin. The expanded diameter 
of the Sear assembly shoulders on the bore of the Primer Pin 
Yoke, preventing Firing Pin displacement and contact with the 
Percussion Primer. The Spring was preloaded to keep the Sear 
assembly shoulder engaged, preventing rattle. The energy 
content in the Spring m inch-pounds is determined by the 
equation l/2kX 2 , where k is the spring constant and X is the 
compression distance. When the Wire Rope pulls on the Sear, 
the Spring is compressed. The Sear releases the firing pin, 
as the Sear clears the Primer Pin Yoke, allowing the Sear's 
angular interlocking finger to slide off the corresponding 
finger on the Firing Pin. The Support Disc prevents too 
great a penetration by the Firing Pin into the Percussion 
Primer. 



Figure 17. Cross sectional view of separation plane initiator 
for Delta Launch Vehicle. 
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5-3 Hot Gas System Characteristics 

o Gas generators pressurize pneumatic system plumbed to 
initiate each aircraft system function (canopy 
jettison, crewmember retraction, seat ejection, etc) 
o Mechanically initiated primer to gas generator 
o Device shear pin retains firing pin prior to stroke 
o Gas pressure at device 1000 psi minimum; 

shear pin fails at about 500 psi 
o Gas generator boosters used for large volumes and 
for long lengths of tubing 
o System pressure integrity critical 


5-4 Explosive Transfer Line Characteristics 

o Explosive impulse is transmitted to each system 

function by mild detonating fuse within steel tubing 
o Identical booster charges In thin-walled cups (tips) 
at each end of line 

o Initiation of input booster causes detonation 

propagation through explosive cord to initiate output 

o This tip creates a pressure impulse and fragments to 
initiate the next line 

o Tip output can also be used to accomplish work 
o Explosive transfer lines can also be flexible with 
fiberglass and steel overbraid for containment of 
explosive products 

o Transfer lines plumbed together like high-pressure 
tubing; free rotating nut on inside shoulder of each 
tip allows threading/ seating into receiving ports 
o Steel tubing allows assembly to be hermetically 
sealed by welding cups to tube 
o Insensitive to initiation by lightning, RF, EMI and 
bullet impact 

o Will burn in fire, but will not build to detonation 
References 5, 23, 24 and 25 


Rubber seal 


Sheath 


Stainless 
steel tube 


Booster tip 


Id detonating 
cord (MDC) \ 



m m 

Teflon extrusion 


Resistance weld 


Steel ferrule 


Figure 18 . Cross sectional view of rigid explosive transfer 
line, also called shielded mild detonating cord 
(SMDC) . 
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Rigid explosive transf'er lines (figure 18) for high- 
temperature environments and the technology for their use 
were developed for the F-lll escape system in the early 
1960's. Explosive transfer from donors to acceptors is 
primarily accomplished by cup fragments. The sketches in 
figure 19 show the explosively driven shrapnel patterns 
produced as the end tip cup explodes. The sketches in figure 
20 show the gaps at which explosive transfers were 
accomplished. The shrapnel fragments produced off the end 
(bottom) of the cup proceed across the gap through the air in 
a contoured front with approximately a one-degree divergence. 
As .these fragments impact against an acceptor tip, a 
sufficiently high impulse is introduced into the acceptor tip 
to initiate detonation in the explosive. The donor cups must 
be fully annealed after forming to produce the fragment 
patterns shown in figure 19, so as to maximize the 
reliability of transfer. Although gaps to five inches are 
indicated between donor and acceptor, a maximum gap of 0.250 
inch is recommended to accommodate the limits of variables, 
such as cup wall thickness and properties, cup breakup, and 
explosive density. In the "end to side" configuration, the 
cylindrical side of the acceptor tip is a poorer target; on- 
coming fragments can be deflected, reducing the amount of 
energy transferred into the acceptor. In the side-to-end 
transfer mode, the fragments produced off the sides of the 
cylindrical cup are strips, like barrel staves. With the 
radial expansion of these fragments, appreciable gaps occur 
between fragments. Note, gaps must be at least 0.006 inch to 
allow the formation of fragments; this phenomenon can be 
explained through the realization that the cup has to expand 
slightly before it bursts to create high-velocity fragments. 


From Lwcito Cup Tests: 



Sid* shrapnol con* 




End shropn*l con* - 
approximately 25 fragnwnte 


(approx.) 


(approx.) 



5° (approx.) 
b*tw**n fragments 


End Vl*w 

Figure 19. Views of SMDC tip fragment dispersion. 
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Figure 20. Gaps at which SMDC fragments initiated acceptors; 
donors and acceptors identical. 


5-5 Shock Tube System Characteristics (Thin-Laver Explosive 
(TLX) ) 

o Shock pulse (6500 feet/second) is transmitted to each 
function in the system through plastic tube with 
interior thin layer coating composed of HMX and 
aluminum (50/50) 

o Deflagrating material in input of assembly is 
initiated by primer or other means 

o output cup can contain deflagrating material to 

transfer the impulse to the next line or can contain 
explosive material to initiate high explosive 
functions 

o Tube can be initiated by some projectile impacts 

Reference 26 


The main advantage of the Thin-Layer Explosive (TLX) approach 
over explosive transfer lines is in weight. Since the shock 
wave is less energetic, explosive containment is more easily 
accomplished. However, this approach lacks the maturity of 
explosive transfer lines, and difficulties have been 
experienced in its application. Care must be taken to assure 
adequate margins in line initiations in multi-port manifolds. 
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5-6 Laser System Characte ristics 

o Coherent light transmitted to all functions within a 
system through fiber optic cables 
o Coherent, high- intensity light generated by lasing 
gas, rods and diodes 

o Light transmitted through connectors and window in 
initiator or pigtail fiber 
o Window and pigtail are sealed to prevent venting 
o Fiber optic cables insensitive to lightning, RF, EMI 
and bullet impact 

References 27 and 28 


The major thrust of laser-initiated pyrotechnic devices is 
the near impossibility of initiating the devices with 
anything but coherent light. This allows installation of the 
pyrotechnic charges early in the assembly of subsystems and 
systems, such as is accomplished with explosive transfer 
lines and exploding bridgewire devices. Laser systems can 
safely allow early installation with weight savings over the 
above-mentioned systems. However, a price is paid; system 
complexity and electrical energy consumption is increased. 
Although laser diodes are small enough to provide a lasing 
source for each pyrotechnic device, eliminating the need for 
complex mirrors or switching mechanisms, the electronics 
necessary to power the diodes are more sophisticated and 
consume considerably more energy than those needed to 
directly fire a hot bridgewire system. This system also 
lacks a significant flight history. Definitions and 
standards are currently being developed to assure functional 
margins at field connectors and at interfaces to the 
pyrotechnic charges. Range safety personnel have yet to 
establish safety and operational criteria. For example, is a 
physical light barrier or an open electrical switch required 
to assure the system is "safed," as has been required for 
electrical and explosive initiation systems? 
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Chapter 6 - PYROTECHNIC SYSTEM SAFETY 
6-1 Properties of Materials 

o Explosive/pyrotechnic and propellant material safety 
properties established by: 

- Impact sensitivity 

- Thermal stability (autoignition temperatures and 
rates) 

- Vacuum stability 

- Electrostatic sensitivity 

- Friction sensitivity 

- Compatibilities with other materials 

- Aging characteristics 

- Explosive input initiation sensitivity 

o Safeguards for initiation systems mentioned above 

References 14 and 15 


Elaborate procedures have been established (usually with 
military specifications) to provide comparative information 
on each of the above properties for raw materials. For 
example, lead azide often has desensitizing agents mixed into 
it, and it is shipped under water, to reduce the opportunity 
of inadvertent initiation. Also, loading facilities are 
designed to accommodate inadvertent initiations; no matter 
what care, procedures and logic are applied, initiations can 
occur. However, once lead azide is properly loaded in 
sealed, electrically conductive containers made of compatible 
materials, it is very stable. 


6-2 Safe/Arm Devices 

o Safe/arm devices provide configurations for: 

- Input isolation (safe) 

- Input transfer (arm) 

o Actuation accomplished by electrical input, 
mechanical input, or both 

- Electrical 

* Safe = ganged electrical switches to short circuit 
and electrically ground firing leads to components 

* Arm = same switches open shorts and connect to 
electrical energy source 

* Electrical command (manual backup) moves switches 

* Verified visually and electrically 
- Mechanical 

* Safe = Physical barrier interposed to prevent 

transfer of explosive, gas, laser or other 
initiation stimuli 

* Arm = Barrier removed to allow stimulus 

to transfer 

* commands can be manual, electrical 
and/or pyrotechnic 

* Verified visually and electrically 

References 19, 20 and 21 
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Figure 21. Cross sectional view of manually operated, 
explosive transfer safe/arm. 


Safe/ arm devices (figure 21) provide positive means for 
assuring that stray energy or an inadvertent firing command 
does not initiate the entire ballistic train. That is, in 
the safe mode, a firing command (electrical, hot gas, 
explosive, etc.) cannot be transmitted. Conversely, in the 
arm mode, a firing command can be transmitted. Electrical 
safing disconnects the firing circuit from the pyrotechnic 
device, as well as provides a short circuit across the 
bridgewire. Arming allows the firing circuit to be connected 
and the short disconnected. These safe/arm commands are 
usually provided with stepping motors to drive rotating 
shafts to the desired position. The shaft location is 
verified by electrical contacts in a separate circuit, as 
well as visually. Mechanical barriers can block initiation 
signal transfer by rotating a shaft or sliding a plate across 
an interface to seal a passage or prevent explosive transfer 
through a transfer charge or cavity. Again, safing and 
arming commands can be electrical, manual and/or pyrotechnic 
with visual and electrical verification. One of the worst 
nightmares at a launch site is that a safe/arm unit does not 
properly cycle through its functions. Consequently, 
elaborate care is applied to seal these devices to prevent 
contamination of moving interfaces and to maintain electrical 
contacts. Adding to this complexity is the use of built-in 
explosive transfer charges, which require special handling, 
storage and assembly procedures as a pyrotechnic device. 
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6^3 Component Safegaurds 


o Components have additional safeguards 

- Hazardous material safety data sheets (OSHA) 

- Safing pins. Remove Before Flight 

- Shear pin strength set to withstand highest level 
inadvertent input 

- Protective caps /connectors for resisting RF , EMI and 
electrostatic energies 

o Procedures provide final safety protection 

- Handling, transport and storage 

- Inspection of components 

- Checkout of firing systems 

- Final assembly 


References 19, 20 and 21 



Chapter 7 - TEST METHODS AND FUNCTIONAL PERFORMANCE 
7.-1 Nop-destructive Tests 

o Non-destructive test inspection required to assure single 
shot item is properly assembled 

- Dimensions of components and final assembly 

- X-ray to image high-density materials 

- N-ray to image organic compounds (explosive materials) 

Reference 29 


7-2 Functional Tests 

o Test methods should represent the function of device 

- Shape, size, volumes, masses, materials 

- Stroke 

- Resistance (friction, shear pin strength, mass, 
mechanical force) 

o Measure input initiation parameters 

- Electrical 

- Mechanical 

- Pneumatic 

- Explosive 

- Laser 

o Measure output 

- Work/ energy 

- Pressure 

- Force 

- Stroke 

o Industry standard measurement for cartridge output, 
closed bomb, does not represent performance in a device 

References 4, 30, 31, 32 and 33 


In order to understand functional performance, test hardware 
must accurately represent the device being tested. As 
described in Chapter 4, a number of interrelated parameters 
affect combustion efficiencies and, consequently, the 
performance achieved. The test program should evaluate both 
input (initiation), as well as output performance. The key 
to evaluation tests is to reduce the expense of testing 
flight hardware by using a controlled, reproducible 
simulation. The widely used closed bomb firing system is 
shown in figure 22. Although electrical initiation 
evaluations can be made, such as in figures 23 and 24, the 
closed bomb's use in measuring the output of cartridges 
cannot predict performance in a device. That is, firing a 
cartridge into a closed, fixed volume accomplishes no work, 
and the parameters affecting combustion efficiencies in a 
device are not simulated. As shown by the typical pressure 
traces in a closed bomb, figure 25, it is not at all apparent 
that the two NSI-derived Gas Generating Cartridges (NGGC) can 
produce more than twice the energy of the two essentially 
equivalent initiators, the Viking Standard Initiator (VSI) 
and the NASA Standard Initiator (NSI) . The energy delivered 
by the NGGC, as determined by a specific output test 
described in section 7-3-1, was 750, versus 340 inch-pounds 
for the VSI. 
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Figure 22. Closed bomb firing and monitoring system. 



Current Applied, amperes 

Figure 23. Typical current versus bridgewire break function 
time curves to evaluate electrical initiation 
characteristics of cartridges. 
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Current Applied, amperes 

Figure 24. Typical current versus first pressure indication 
function time curves to evaluate electrical 
initiation characteristics of cartridges. 



Figure 25. Typical pressures produced by cartridge firings in 
a closed bomb. 
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7-3 Types of Functional Performance Tests and Determination 
Qf Functional Margin 

o Examples of functional performance tests 

- Piston/cylinder configurations 

- Ignitability 

- Explosive transfer or initiation of explosive acceptors 

- Explosive severance/ fracture 

* Flexible linear shaped charge {FLSC) 

* Lockheed's "Super*Zip" separation joint 

- Structural containment 

o Functional margin ("how well" something performs) is 
determined by measuring and comparing 

- Energy required to accomplish function 

to 

Energy deliverable by pyrotechnic source 


- Relative rate of ignition produced by one initiator type 

to 

That produced by other initiators under consideration 


- Determining minimum explosive load to accomplish function 
(while maintaining flight configuration) 

to 

flight explosive load 


- Determining key functional parameters, measuring their 

performance at limits of functionality 

to 

flight configuration 

(For example, plate severance is enhanced by the bending 
of the plate during fracture; tests would be conducted 
at the thinnest and thickest limits of the plate.) 

o Uniformity of performance is key to understanding 

- Conduct multiple tests, 5 to 10 minimum 

- Provides adequate definition if standard deviation is a 
small percentage of the mean 
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Serious shortcomings exist with "go/no-go testing" and the 
widely cited +/- 15% "margin demonstration criteria." 

"Go^no-go testing" is accomplished by assembling devices and 
firing them without measuring functional parameters. That 
is, they either do or do not accomplish the desired function. 
The shortcoming is that there is no way to determine how 
close the device was to failing, either through inadequate 
functional or structural containment margins. In testing 
identical devices, more than 2000 successful, consecutive 
functional tests would have to be conducted to obtain a 
simplistic reliability prediction of 99.9%. 

Margin criteria for pyrotechnically actuated devices were 
first created for the Gemini Program in the early 1960's. 
These criteria are the go/no-go firing of a few devices at 
15% under and over-load to demonstrate that an 85% 
pyrotechnic load would still function the device and a 115% 
overload would not cause rupture of the device. Although 
these criteria implied some confidence in performance, no 
quantitative information is produced. Also, under certain 
conditions, the performance of pyrotechnic devices actually 
increased with an 85% load. 

The following test methods are recommended to overcome these 
shortcomings. 


7-3-1 Recommended functional tests for piston/ cylinder 
conf igurat ions 

- Energy reguired measured by dropping mass onto piston 
to find minimum energy reguired to accomplish function 

- Energy deliverable determined by measuring 

* Crush of honeycomb: Energy = Crush Distance X Strength 

* Velocity of moving mass: Energy = l/2mv 2 

References 4, 30, 31, 32 and 33 


The energy required to accomplish the stroking of a piston in 
a mechanical function is determined by controlled drop 
testing of small masses onto the piston to be stroked. The 
energy required to accomplish the function is the drop height 
multiplied by the weight to provide a value in inch-pounds. 
Ideally, a high velocity of the falling mass simulates the 
dynamics of the pyrotechnically driven piston. While this 
simulation may not be perfect, it is certainly better than 
the current practice in which sellers and users of 
pyrotechnic devices often have no idea of the energy required 
for functioning. 
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The energy delivered by a gas generating cartridge can be 
measured by the McDonnell Energy Output Test Fixture (Energy 
Sensor) or by measuring the velocity of the piston. The 
Energy Sensor, figure 26, represents an application of 
working against a constant force, using calibrated aluminum 
honeycomb against which the cartridge-driven piston strokes. 
Energy is obtained by multiplying the amount of crush in 
inches by the honeycomb's crush strength to provide a value 
in inch-pounds. Several examples are shown for various 
cartridges in table IX: the Viking Standard Initiator (VSI) 
and the NSI-derived Gas Generating Cartridge (NGGC) . 


Energy sensor Initiator firing block 



Figure 26. Cross sectional view of McDonnell Energy Output 
Test Fixture. 


TABLE IX - ENERGY SENSOR PERFORMANCE DATA ON TEST CARTRIDGES 

(Average /Standard Deviation) 

Cartridge No. Fired Energy Delivered 

inch-pounds 


Performance Baseline (No Environments) 


VSI 

5 

466/21 

Hi-Shear NGGC 

5 

815/99 

UPCO NGGC 

5 

812/90 



Post Environmen 

Hi-Shear NGGC 

16 

869/80 

UPCO NGGC 

12 

927/58 
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To determine energy by measuring the velocity of the piston, 
the LaRC Dynamic Test Device and a Pin Puller have been 
employed. The Dynamic Test Device, figure 27, represents a 
jettisoned mass application and employs a one-inch diameter, 
one-pound mass that strokes one inch to clear the o-ring. 

The velocity of the mass is measured by an electrically 
grounded needle, mounted on the face of the mass, 
sequentially contacting five, 0.25-inch spaced aluminum foil 
••make” switches. The 0.25-inch spacing, divided by the time 
interval, yields velocity. The pressure traces produced by 
several different cartridges (the NSI-derived Gas Generating 
Cartridge (NGGC) and the Viking Standard Initiator (NSI) are 
shown in figure 28. These pressure measurements cannot be 
used as a direct indicator of energy delivered by the 
cartridge. Once the total energy is measured for any 
particular pressure trace, the integral of a different trace, 
which was produced in the same device, can be used as a 
relative indicator of energy for the second trace. 



Figure 27. Cross sectional view of NASA LaRC Dynamic Test 
Device. 
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Pressure, psi 



Figure 28. Typical pressure traces recorded and the energies 
produced in firing cartridges in the Dynamic Test 
Device. 


The NASA Pin Puller, figure 29, was developed for a 
spacecraft function, and because it has rugged steel 
construction, it has been useful for comparative testing. In 
this case, energy was measured by the velocity of the pin and 
the amount of crush in the calibrated Energy Absorbing Cup, 
which crushed at the end of the stroke. Typical pressure 
traces for the VSI and NGGC in the Pin Puller are shown in 
figure 30. The test setup for this data collection allowed 
the piston to jettison, rather than stopping at the end of 
stroke. A logical question in comparing the energy delivered 
by the same cartridges in three different test devices is 
"Why isn't the energy the same?" The Energy Sensor measures 
more of the energy, because it doesn't vent like the other 
two test methods. The Dynamic Test Device has a very lar^e 
piston face exposed to the working gas, compared to the Pin 
Puller. The Pin Puller has a tortuous path for the hot gas 
to pass from the cartridges to the piston; the cartridge 
starts the flow at 90° from the axis of the piston, is forced 
through a 0.10-inch diameter orifice and then pressurizes a 
narrow working face of the piston. It is also clear that the 
initial free volumes among the three test methods were 
completely different, which caused considerably different 
combustion of the gas generating materials and pressures 
produced. For example, the area exposed to the hot gas in 
the Pin Puller produced a considerable heat sink, changing 
both the temperature at which the combustion occurred, and. 
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consequently, the burn rate and the quantity of gas produced. 
The amount of residue (unburned fuel) following the firings 
in the three test methods was testimony to these effects; the 
Pin Puller had the most. 

These results clearly demonstrate why closed-bomb tests 
cannot predict performance in a device. Care must be taken 
in the selection of a cartridge energy-measuring method, so 
that the test closely simulates use in the production device. 


7.3.2 - Recommended test for determining ignitability (output 
initiation performance of cartridges and ignition 
sensitivity of materials) 

- Pressure at one millisecond 

- Peak pressure 


References: 34, 35 and 36 


The principle for determining the output ignition performance 
of initiating devices, such as percussion primers and 
cartridges, is to fire the devices onto a controlled bed of 
combustible material (referred to hereafter as ignition 
material) and measuring the way this ignition material 
responds (ignites and burns). Conversely, to determine the 
sensitivity of materials to be ignited a controlled initiator 
is fired onto the combustible material under evaluation. The 
approach for these determinations is to enclose the ignition 
material in a sealed volume and monitor the rise in pressure, 
created from the burning material. Intuitively, the better 
the initiator performs, the more rapidly the ignition 
material ignites, burns and pressurizes the volume. 

The NASA Ignitability Test Bomb, as shown in figure 31, was 
initially designed to evaluate percussion primers. However, 
the configuration can be modified to incorporate any type of 
initiator. The ignition material is placed in a 
hemispherical cavity in the ignition material holder. This 
holder has vent holes to allow the gas to vent to the lower 
portion of the volume, where pressure is measured. The 
percussion primer is installed in the primer holder, which is 
sealed within the adaptor. A firing pin is installed into a 
port within the adaptor, and rests on the percussion primer. 

A weight is dropped onto the firing pin from a controlled 
height to assure adequate initiation of the primer. The data 
recorded on a high-speed magnetic tape recorder consists of 
the strike of the firing pin, as measured by an accelerometer 
mounted on the drop weight, and two pressure traces. Figure 
32 shows the pressure produced as a response to the input of 
two different percussion primers, the M42C1 and M42C2 fired 
into 200 milligrams of FFG particle size black powder. 
Clearly, the M42C1 ignites the black powder more quickly. 
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Figure 31. Cross sectional view of NASA LaRC Ignitability 
Test Method bomb. 



I IME - MILLISECONDS 


Figure 32. Typical pressure traces produced by the M42C1 and 
M42C2 percussion primers in the NASA Ignitability 
Test Method, using 200 mg of FFG black powder. 





Figure 33 shows how these data were compiled for analysis. 

The time from the firing pin strike to an indication of 100 
psi pressure was defined as primer output delay. This is a 
slightly longer time interval than that required for the 
primer to be initiated by the firing pin. Because the first 
indication of pressure rise is often difficult to detect, the 
100 psi level was arbitrarily selected. This level provides 
a more precise start point. The pressure achieved within the 
first millisecond, following the 100 -psi pressure level, was 
selected for ratioing to the peak pressure achieved, and was 
defined as ignitability . The initiator that produces a 
higher pressure at one millisecond, as compared to other 
initiators, indicates a greater ignitability and thus, a 
faster initiator. The initiator selected for any particular 
application does not necessarily depend on a high rate of 
ignition; some applications, such as initiating time delays, 
require a soft, slow initiation, so as to not to damage the 
delay columns. 



Figure 33. Percussion primer ignitability performance 
definitions. 


The ignitability Test Method can be similarly applied to any 
initiator, whether electrical, explosive or laser. 

For evaluating the relative sensitivity of various ignition 
materials, figure 34 shows the response of three different 
materials to initiation inputs from M42C1 and M42C2 
percussion primers. Clearly, the FFG black powder was more 
sensitive to ignition than was the much coarser A cannon 
black powder. The most difficult to ignite was the Type I 
particle size BKNO 3 . The same ignitability definition, 
ratioing the pressure achieved at one millisecond to the peak 
pressure, applies. 
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Tine - milliseconds 

Figure 34. Ignitability comparison of three ignition 

materials, each ignited by the M42C1 and M42C2 
percussion primers. 


7.3.3 - Recommended Tests for Explosive Transfer 

o For explosive transfer from a donor to an acceptor, measure 

- Fragment velocity /energy delivered by the donor 

- Fragment velocity /energy required to initiate 

References 5, 23, 24, 29, 30, 31, 37 and 38 


Initiation of high explosives across hermetically sealed 
interfaces is accomplished primarily by high velocity 
fragments from the donor. In the case of explosive transfer 
lines (described in Chapter 5) the 0.005-inch wall thickness 
302 stainless steel cup fragments, and the particles 
accelerated to velocities of 8,000 to 10,000 feet/second as 
the 65-milligram explosive load within the cup explodes. The 
shape, impact pattern and velocity of the fragments depend on 
parameters such as: 1) cup material, properties and 
thickness, 2) explosive material, particle size and loading 
pressure, and 3) the medium through which the fragments pass 
(usually air) . The test setup used to monitor the donor- 
delivered fragments is shown in figure 35. Fragments are 
created off the end and off the side of the cup. Aluminum 
foil "make" switches, spaced known distances from the cup 
provide time intervals to calculate velocities. The energy 
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Pattern 1 


Pattern 1 



• V-j - Line detonation transfer velocity 

• Vo - Axial tip fragment velocity 

• - Side tip fragment velocity 

• Pattern 1 - Radial fragment pattern in acrylic 

• Pattern 2 - End fragment pattern in acrylic 


Figure 35. Schematic diagram of test fixture to monitor 
fragment patterns and velocities from rigid 
explosive transfer line end tips. 


delivered by these fragments is obtained by calculating 1/2 
mv 2 , where m is the mass of either the end or side of the 
cup. The impact patterns, created by these fragments, are 
obtained using the acrylic witness plates. Explosive 
transfer line performance has been uniform and reliable over 
the 30-year history of their application. 

The energy required to initiate an acceptor explosive is 
obtained by impacting acceptors with fragments of known 
velocities. To determine the minimum threshold for 
initiation, donor tips were manufactured with smaller 
quantities and densities of explosive materials, as well as 
using different types of donor cup materials. 
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7.3.4 - Recommended Tests for Explosive Severance/Fracture 

o For linear explosive severance/ fracture, use tapered plate 

- Flexible linear shaped charge (FLSC) 

- Mild detonating fuse 

- Lockheed's "Super*Zip" separation joint 

o Measure maximum fracture capability in each test 

o Test setup must simulate flight applications 

- Structure - Material properties 

- Explosive load - Explosive backup 

o Functional margin achieved by sizing explosive load, based 
on the ratio of either: 

- the explosive flight load 

to 

the minimum explosive load required to sever structure 
or 

- The minimum structural thickness severed by the flight 
explosive load 

to 

the flight structural thickness 

References 30 and 39 


The use of tapered plates, as shown in figures 36 and 37 
provides a way of determining the limit performance of each 
length of linear explosive for every test. That is, the 
maximum thickness of the plate is set so that the linear 
explosive cannot fracture along its entire length. With this 
method, system parameters, such as explosive load, sheath 
materials and separation distance between the explosive and 
the plate to be severed can be optimized. For this 
information to be applicable to the flight system, the test 
setup must accurately simulate the flight configuration. The 
linear explosive test fixture in figure 36 shows a method to 
measure the severance capability, as well as the energy 
delivered by a length of the explosive (using the McDonnell 
Energy Sensor) , and the velocity of explosive propagation 
down the length of the explosive. Figure 37 shows the test 
setup for the Lockheed "Super*Zip" separation joint in which 
an explosively expanded tube fractures plates on both sides 
of the tube at the notched area (ligament). For this 
investigation the thickness of the plate was tapered and the 
depth of the notches was held constant. The most influential 
parameter in achieving fracture was the thickness of the 
plate; the plate must bend at the bolt line to fail at the 
notched areas in tension. 
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Figure 36. Test fixture to evaluate the output of linear 
explosives. 


i r°- : 





'Tape L_ 
layers (2)T 

ii ii 

r Tape i 
layer \ 


R f 


1.70 i 

i h 

I— 0.250 



0.060-diam 
ball end mill 


- 0.065 doubler web 


0.123 doubler web- 


0.037 ligament- 


- 0.095 ligament 


Figure 37. Lockheed Super*Zip separation joint tapered plate 
test configuration. 




7.3.5 - Recommended Tests for Demonstration of Structural 
Containment 

o Successful functioning shall not create a hazard 

- Venting of fluids/gases 

- Fragments/debris 

o Require fail-safe demonstrations 

- Lock-shut (fire, while preventing mechanisms from 
stroking) 

- Function with minimum containment structure 

- Increase explosive load 

- Reduce initial free volume in combustion chamber 
o Functional margin based on comparing 

- Flight structure to minimum structure that maintained 
integrity 

- Explosive load where rupture occurred to flight 
explosive load 

- Pressure where rupture occurred to flight pressure 

Note: It is not necessary to test devices to rupture failure 
if acceptable structural margin can be demonstrated. 

References 20 and 21 
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Chapter 8 - FUNCTIONAL RELIABILITY 


o Device reliability achieved by 

- Understanding of device mechanism through development 

* Effects of variables 

* Functional limits 

* Energy delivery mechanisms 

* Effects of environments 

- Determining functional margins 

- Qualification testing/ environmental survivability 

* Measure performance before and after environments 

* Compile further performance data to substantiate 
functional margin demonstration 

- Go/no-go testing of a small number of devices does 
not measure reliability 

o Reliability can be determined by statistical comparison 
of energy required to energy deliverable 

References 1, 4 and 40 


Functional reliability must be evaluated on each device. 

Each device should be evaluated through three phases: 
development, determination of functional margins, and 
qualification. This should be followed by system integration 
and demonstration. The information collected throughout this 
effort can be analyzed to produce classical statistical 
reliability estimations. Every test firing should be 
designed to produce functional data that will contribute 
toward defining reliability. 

For each component, functional evaluations should be 
conducted to understand the device's mechanisms and the 
effect of parameter variability. Tests should be conducted 
to functional limits. That is, tests should be conducted to 
determine where devices fail to function to evaluate 
parameters, such as structural strength and minimal 
pyrotechnic energy input, and where structural failures 
(rupturing) occur. The manner in which energy is delivered 
within and by the device should be determined. The most 
influential environment affecting combustion is temperature. 
At cold temperatures, both ignition sensitivity and burn rate 
decrease. This combination normally produces the lowest 
energy output. At high temperatures, the reverse occurs. 
Also, at high temperatures, structural strength can be 
reduced. The combination of higher combustion efficiency and 
lower structural strength can push devices beyond structural 
limits. 

Currently applied go/no-go tests do not provide information 
on functional performance, and contribute very little to 
reliability predictions. When a device successfully passes 
qualification testing, which typically requires 10 to 200 
firings, the specification reliability is assumed to have 
been met. The reliability/confidence predictions currently 
in existence have been created by compiling the success of 
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past devices that are remotely similar to a particular device 
under evaluation. Unfortunately, this logic is flawed, since 
the primary assumption in large-sample statistical evaluation 
is that all devices in the sample are identical. Examples of 
devices that have achieved significant, large-sample 
statistical demonstration from actual firings are explosive 
transfer lines and the NASA Standard Initiator (NSI) . 

A statistical reliability estimate can be obtained through 
the analysis of all the functional performance data collected 
through development, qualification, integration and checkout 
of the device under evaluation. As shown in figure 38, 
comparing the distributions of energy required to perform a 
function to the energy delivered will provide a statistical 
baseline. Clearly, the greater the separation between these 
two distributions the more assurance that the function will 
be accomplished, the 3.89 standard deviation refers to a 
typical distribution where 99.9% of the data is included. 
However, if the two distributions overlap, failures can 
occur. Statistical tables, as described in reference 40, 
predict reliability, based on small-sample distributions. 




Figure 38. Graphic representation of statistical design 

margin, comparing normal distributions of energy 
required to perform a function to energy supplied 
by a cartridge. 
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o System reliability enhanced by redundancy 

- Use of parallel, independent paths to perform a single 
function 

- Prevent single-point failures 

- Degree of redundancy depends on system tradeoffs 

* depends on criticality of function 

* achieved by design approach 

o Use of redundancy to assure success introduces 
contradictions - Increases complexity of systems 

- Increases chances of inadvertent functioning 
o Does not alleviate need for quality assembly or 

functional margin demonstrations of components and 
interfaces 


Reference 1 


Redundancy is defined as accomplishing a function through two 
completely independent paths. In example A, figure 39, two 
electrical firing systems each give a command to Single 


A. REDUNDANT FUNCTIONAL SYSTEMS 



B. REDUNDANT DEVICES 



C. REDUNDANT CARTRIDGES 



D. REDUNDANT SBASI 



Figure 39. Levels of pyrotechnic redundancy established by 
the Apollo Program. 
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Bridgewire Apollo Standard Initiators (SBASI, the predecessor 
to the NSI) , which in turn ignites the cartridge energy 
sources to one of two devices, such as pin pullers, either of 
which releases an interface to accomplish a desired function. 
In this case, each system works independently without any 
influence on the other. However, as shown in example B, the 
two pin pullers could be designed to directly accomplish the 
function without an interface. In example C, two independent 
systems through the cartridge level could provide inputs into 
a pin puller; in this case, either cartridge has sufficient 
energy to independently actuate the pin puller and accomplish 
the function. Finally , independent SBASIs could be used to 
ignite a single cartridge to actuate the pin puller. Single 
point failures occur in the system in example B, the system 
and the pin puller in example C, and the system, device, and 
cartridge in example D. The level of redundancy depends on 
the criticality of the function and is achieved by design. 
That is, simplified designs may actually be an improvement 
over total redundancy. For example, system complexity in 
terms of the number of components and interfaces can increase 
the opportunity of failure. Furthermore, the possibility of 
inadvertent functioning increases with twice as many firing 
systems. In any case, the use of redundancy does not 
alleviate the need for designing, demonstrating and producing 
components and interfaces of the highest quality and with the 
ability to resist inadvertent functioning or failure to 
function. Redundant systems should not be counted on to 
accomplish the function; each system should be expected to 
accomplish the function, even if the other did not exist. 

A special word of caution is warranted for the use of cross- 
overs in explosive transfer lines, figure 40. Designers have 
fallen into the trap of putting cross-overs at the output 
tips of devices, such as time delays. The concept is that, 
since the output of time delays won't function 
simultaneously, the earliest arrival will trigger the system. 
Or, if one path had stopped functioning, a cross-over would 
reinitiate that path. However, the fallacy lies in the 
possibility that the first input to arrive may cause the 
cross-over to malfunction, which in turn can destroy the 
second time delay output, causing a loss of propagation in 
the second path. 

This discussion on success and failure leads to the 
contradictory problem faced by the pyrotechnic specialist. 

As shown in figure 41, the need to prevent inadvertent 
initiations must be balanced against the need to assure that 
initiation has been achieved. To prevent initiation, all of 
the safety features described above are employed. These 
features may be so successful that initiation is prevented. 

A great deal of effort must be made in assuring that these 
safety features are successfully disabled to properly "arm" 
the system to allow an initiation command to be transmitted. 
Conversely, to assure initiation is achieved, the sensitivity 
of devices to initiation commands must be increased to a 
reasonable level without unduly impacting safety features. 
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HIGH EXPLOSIVE OUTPUT 



-SMDC 


FALSE REDUNDANCY 



TRUE REDUNDANCY 

Figure 40. Example of false redundancy in the use of 
explosive crossovers. 



Figure 41. Depiction of the need for the pyrotechnic 

specialist to meet both safety and reliability 
requirements. 
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Chapter 9 - SYSTEM APPROACH FOR APPLICATION OF PYROTECHNICS 

o Appoint a pyrotechnic manager 
o Compile system requirements 

- Performance 

- Physical envelope 

- Interface with flight vehicle 

- Environments 

- Schedule 

- Reliability/simplicity 

- Service 

- Cost 

- Project experience 

- Management preference 

The most important task for project management is to 
recognize that pyrotechnics must be a separate engineering 
discipline from those that are obvious, such as structure, 
electrical power, propulsion, telemetry and thermal control. 
Pyrotechnic subsystems accomplish a wide variety of critical 
functions, such as initiation, staging, ejection and release, 
and, consequently, must interface with most other on-board 
systems . 

A compilation of the requirements on a quantitative basis is 
the most valuable framework for driving the design, 
development, qualification and integration of pyrotechnic 
systems. Realizing that tradeoffs will have to be made 
throughout the effort, flexibility in requirements and 
approach must be emphasized. A classic example is 
establishing a requirement for emergency escape from an 
aircraft over a range of zero velocity/ zero altitude through 
supersonic speed at high altitude. The problem is that 
escape under supersonic conditions may require many times the 
cost, time and effort, than for subsonic escape. 

Historically, the preponderance of in-flight escapes for 
supersonic aircraft have been at subsonic conditions. 

The two statements on project experience and management 
preference cannot be discounted. It is often wise to 
continue the use of hardware and logic that is well proven 
and is familiar to project personnel. Project management 
often has a preference, based on experience, which becomes 
the baseline from which all concepts are compared. That is, 
when another approach is offered, advantages and 
disadvantages should be compared to the project experience 
and preference. 


o Compile history of similar past applications 

- NASA LeRC compiling catalog 

- Contact past program managers/designers 

- Drawings 

- Functional performance/understanding 

- Environmental demonstrations 

- System performance 

o Negotiate/select approach and functions that most closely 
meet requirements 

- Cannot be unilateral decision 

- Interfacing system managers may not appreciate 
pyrotechnic engineering logic 
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This kind of homework is valuable in preparing trade studies 
and supporting recommendations. Unfortunately, few projects 
have the time to document the logic used in making selections 
of devices. Even more important is determining the 
••pedigree" of the selected hardware: 1) development history, 
including functional margin demonstrations, 2) qualification 
demonstration, and 3) lessons learned from failures. Since 
there is very little engineering training in the unique 
energy sources offered by pyrotechnics (reference 3) , 
personnel with limited hands-on experience are often assigned 
and reluctantly accept program responsibility. Few positions 
within a project require such preparation (starting from a 
modest technology baseline with limited definitive standards 
or specifications for design, development, qualification and 
integration) . Consequently, when the project concludes, 
these personnel are grateful to have successfully "survived" 
the experience and few stay on in the field for the next 
project. NASA Lewis Research Center is compiling a catalog 
of pyrotechnic applications and devices, which should be 
useful in beginning the search cycle. Most of the 
information on pyrotechnic devices is from manufacturers. 

They have listings of past successful applications of their 
devices and often the qualification reports. Unfortunately, 
since current specifications do not require quantitative 
functional margin demonstrations, the insight into how these 
devices and systems were developed is often lacking. 
Pyrotechnic devices are presented by manufacturers as "off- 
the-shelf," like nuts and bolts, needing only "minimal" 
modification to meet the specific requirements of the current 
mission. The pyrotechnic manager, while developing 
requirements, is faced with digesting this myriad of 
information from the manufacturers on their hardware. 

After compiling needed information, conducting trade studies 
and making recommendations to the project, the pyrotechnic 
manager must be prepared to negotiate the final approaches. 
These negotiations must be made with the managers that are 
responsible for systems that interface with the pyrotechnic 
systems. These negotiations will likely continue throughout 
the life of the project. Recognizing that little engineering 
logic has been available for pyrotechnic applications, it is 
necessary to assist the managers of interfacing systems with 
the specific information needed to achieve integration. 


o Compile detailed performance requirements 
o Determine integration approach 
o Obtain approval from interface managers 

Once general agreement has been achieved regarding the logic 
and principles to be used in applying pyrotechnic systems 
within the project, detailed specifications can then be 
compiled. It is important to provide information in the 
specifications that maintains an overview of what the 
objectives of the pyrotechnic subsystems are and how the 
pyrotechnic devices are to be integrated into the system. 
Managers that interface with pyrotechnics must approve the 
specifications, and be kept abreast of the developmental 
status . 
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chapter 10 - GENERATE PERFORMANCE-BASED SPECIFICATIONS 
o Describe approach to system 

o Define system physical and performance requirements 
o Define component physical and performance requirements 
o Require demonstration of functional margin for components 
and systems contracted; go/no-go testing alone unacceptable 
o Require demonstration of environmental resistance 
(qualification) 

o Confirm functional margin in lot acceptance testing: 

require performance demonstration at a level greater than 
worst-case flight conditions 

Pyrotechnic specifications should be constructed to insure 
that the functions to be accomplished and the logic to be 
used are clearly understandable. The function for each 
pyrotechnic device, as well as the overall system, should be 
readily apparent. This will assist in assuring that all 
interfaces are defined and that the end goals are 
accomplished. Physical envelopes should be defined so as not 
to restrict the types of devices and their functional 
approaches. Performance of devices should be defined in 
quantitative parameters and margins, based on the functions 
to be accomplished, rather than attempting to specify 
physical details of design. For example, a pin puller should 
be described in terms of the loads to be accommodated and the 
functional margins required (energy deliverable by the 
cartridge, versus energy required to accomplish the 
function) . In the field of pyrotechnics, it is very 
difficult to produce a device with a M build-to-print M 
specification, since very subtle changes can significantly 
affect performance. Every functional test should be designed 
to yield quantitative performance information; go/no-go 
testing should be eliminated. 

Once functional margins have been established for devices 
under system requirements and conditions, then the devices 
can be subjected to environmental qualification. The design 
and demonstration accomplished to this point should provide 
confidence that these devices should be capable of 
withstanding all environments. At this point, quantitative 
measurements of performance must be non-lnvasive. Devices 
must be assembled as flight-configured units and measurements 
cannot influence the performance during functioning. 

However, external measurements can be made, such as observing 
the velocity of a pin during stroking. Also, quantitative 
functional data can be obtained after a firing through x-ray 
and teardown of the device to reveal internal, precalibrated, 
metal deformation, such as an energy-absorbing cup or the 
amount of penetration of a piston in a tapered bore. 

Performance verification and functional margin demonstration 
should be accomplished for acceptance of new lots of devices. 
For example, the test should be configured to require a 
worst-case flight condition. Again, quantitative functional 
data should be collected non-invasively and/or from post-test 
evaluation. 
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Chapter 11 - PYROTECHNIC COMPONENT DESIGN AND DEVELOPMENT 

o Utilize engineering experience 

- Energy delivery capabilities 

- Materials/configurations 

- Scaling 

- Compatible materials 

- Pyrotechnic charge 

o Monitor functional performance 
o Determine /evaluate key functional parameters 

Reference 4 


The first cut at selecting and sizing the device, its 
components, and its performance should be based on the 
company's experience with comparable hardware. As described 
in chapters 3 and 4, the possibilities and combinations are 
nearly unlimited. One approach would be to use existing 
hardware with minimal modifications and hardware that had 
been qualified previously on a similar application. The 
foundation to a successful design effort is to monitor 
performance to determine and evaluate key functional 
parameters; that is, those parameters, when slightly changed, 
that most influence performance. 


o Conduct development 

- Adjust performance to optimize 

- Conduct functional evaluation to limits of requirements 

* Forces/ loads 

* Materials/conditions 

* Environments 

o Establish structural integrity 

- Locked shut 

- Pyrotechnic overload 

- At conditions of maximum stress, i.e. temperature 

- Dual-cartridge device must survive simultaneous firings 
o Determine functional margin/reliability 

References 4, 20 and 21 


Development should be conducted to optimize the first five 
parameters (energy delivery, materials/configurations, 
scaling, compatibility and pyrotechnic charge) by conducting 
functional evaluations to the limits of requirements. 

Also affecting this optimization is the requirement to 
maintain structural integrity. That is, the resistance to 
rupture of the pressurized structure can be evaluated by a 
locked-shut test (preventing stroke or motion of a piston) , 
or a pyrotechnic overload at conditions of maximum stress, 
such as at temperature extremes. For those devices that 
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utilize dual energy sources, such as cartridges or explosive 
cords, for redundancy (the device must function with the 
output of either energy source) firings must be conducted 
with simultaneous initiation of both energy sources. This 
must be done, even though in the system, only one cartridge 
is fired at a time; the possibility exists that both energy 
sources can be fired. Functional performance measurements 
should be taken during these tests to quantify the degree to 
which structural containment was achieved, or how close the 
structure was to failing. Maximizing the performance of a 
device is contradictory to maintaining structural integrity. 
That is, using a large pyrotechnic charge to achieve a large 
functional margin will increase the potential of structural 
failure. A second contradictory factor is the generation of 
pyrotechnic shock, described in chapter 13, which is 
increased by greater dynamics from large pyrotechnic loads. 

At this point, the structural margin and reliability of the 
device, as described in chapters 7 and 8 can be determined. 
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Chapter 12 - QUALIFICATION 

o Determine the survivability of design to environments 
o Demonstrate subsystem performance 
o Compile additional data on functionality (margin) 
o Various test philosophies 

- Test all units through all environments 

- Subdivide test units to allow sequential exposures 
o Number of test units depends on: 

- Criticality of subsystem 

- Expense 

- Complexity 

- Ease of evaluation 

o Final firings should be conducted in system-level tests 

- Worst-case loads 

- Worst-case environments 

- Structural integrity 

References 2, 4, and 41 

The objectives of component and subsystem qualification are 
to demonstrate the capability to withstand environments and 
to compile additional information on performance. By 
determining the level of performance, based on dynamic or 
passive energy measurements, this data will provide further 
substantiation of functional margin demonstrations. Two 
basic approaches exist in regard to conducting environmental 
exposure tests: 1) exposing all test units to all 
environments, and 2) subdividing the test units for 
sequential exposure to environments. For example, with 5 
groups of test units and 5 environments, group 1 would be 
subjected to environment 1 and functionally tested, group 2 
would be subjected to environments 1 and 2 and functionally 
tested, group 3 would be subjected to environments 1, 2 and 3 
and functionally tested, etc. With a thorough understanding 
of the effects of environments from the developmental effort, 
qualification testing should produce no surprises. However, 
without a thorough development, test units are subdivided for 
sequential exposures. This allows for determination of which 
environment had a deleterious effect on performance. At the 
conclusion of environmental exposures, the test units should 
be functioned at physical and environmental extremes, as well 
as demonstrate structural integrity. 
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Chapter 13 - PYROTECHNIC SHOCK 

o Pyrotechnically induced mechanical environment 

- Suspected cause of Galileo computer memory loss 

- Magellan, Mars Observer powered down before firing 
pyrotechnics 

o Dynamic, impulsive compressive/ tensile waves generated by: 

- Rapid pressurization of gas-actuated mechanisms 

- Impact of mechanical interfaces 

- Sudden release of loads at loaded interfaces 
o Contains frequencies to over 40 khz 

o Dynamicists/ accelerometers ignore readings above 10 khz 

- Accelerometers resonate, produce large output 

- Limitations on simulators 

- Assume higher frequencies do not damage 

o Viking project required pyrotechnic shock testing 

- Impacting mass simulator induced considerable damage 

- Abandoned above approach for system-level demonstrations 
o Recommend system-level demonstrations 

- Actual or closely simulated structure 

- Actual pyrotechnic devices 

- Test item mounted on structure as flown 

- Eliminates concern of simulation 
o Comparison testing 

- Use Hopkinson Bar with strain gages 

- Frequency response to 80 khz 

- Each pyrotechnic design generates reproducible strain 

Reference 42 


Recent spacecraft failures have been associated with a 
mechanical environment called pyrotechnic shock. Following 
the loss of memory on a backup computer in the Galileo 
spacecraft, the Magellan and Mars Observer spacecraft have 
been powered down, prior to firing pyrotechnics. A firing 
command for pyrotechnically actuated valves was the last 
signal to be transmitted to the Mars Observer before 
communications with the spacecraft were lost. Since the 
spacecraft had no onboard systems in operation, no diagnostic 
information could be obtained to analyze the failure of the 
spacecraft. 

When pyrotechnic devices are functioned, dynamic, impulsive 
waves of compressive and tensile strain are produced within 
the device and through the release of loads at structural 
interfaces. On functioning, pyrotechnic devices produce 
strain by rapid, high pressurization of gas-actuated 
mechanisms and the impact of these mechanisms at the limits 
of the function. An example of the sudden release of loads 
is a bolted interface released by explosive bolts. These 
strain waves contain frequencies to over 40 khz. A 10 khz 
upper frequency level is an artificial constraint applied by 
dynamicists, due to the limitations of accelerometers and the 
equipment used to simulate pyrotechnic shock inputs. An 
assumption is made that frequencies above 10 khz cannot 
damage structure. However, small-mass electronics have 
exhibited sensitivities in this regime. 
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Pyrotechnic shock testing was an early requirement on the 
viking Program, the soft landing of two instrumented payloads 
on the surface of Mars. Impact test pyrotechnic simulations 
always produced severe overtests, destroying many test items. 
The pyrotechnic shock simulation requirements were 
continuously reduced and, ultimately, were abandoned in favor 
of system-level demonstrations. 

Only system or subsystem pyrotechnic shock tests should be 
conducted, using the actual or closely simulated structure, 
with the actual pyrotechnic device and the test item mounted 
and functioned as in flight. To compare the shock produced 
by various pyrotechnic devices, a Hopkinson bar setup should 
be employed. 

The complex shock waves generated by individual pyrotechnic 
systems, monitored on a Hopkinson bar with high-response (80 
khz) strain gages, have demonstrated a remarkable degree of 
reproducibility. The Hopkinson bar is a one-inch diameter, 
10-foot long steel bar, which represents a simplified 
structure. The shock wave propagates undisturbed down the 
length of the bar with only a simple reflected wave at the 
end of the bar opposite to the end on which the pyrotechnic 
device was mounted. The length of the bar allowed the 
complete initial transient pulse to be recorded without 
interference from the reflected wave. Multiple firings 
(reference 39) of separation nuts produced strain signals 
that overwrote one another. 

However, pyrotechnic shock simulation is questionable, since 
the dynamics of a mechanism are difficult to duplicate and 
the accelermometer-based data acquisition cannot provide 
linear response. Therefore, it is difficult to be assured of 
good simulations, risking the possibility of over or under- 
testing. 
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Chapter 14 - FAILURE MODES AND EFFECTS ANALYSES 

o Consider and list what can "go wrong," such as: 

- Improper assembly (mechanical hardware and firing system) 

- Inadvertent command 

- out-of -sequence command 

- Mechanical hangup 

o What can result if incidents occur 

o Put emphasis on preventing incidents and demonstrating 
system capabilities 

- Device and system design/ functional margins 

- Personnel awareness 

- System schematics/diagrams 

- Procedures 

o Use mockups of devices and subsystems 

Failure Modes and Effects Analyses (FMEAs) are more than just 
a paperwork game to be played after a pyrotechnic device and 
its application have been designed, developed and qualified. 
FMEAs (what can "go wrong," and what can result) should be 
considered throughout the effort, from the earliest 
conceptualizations, through qualification. In fact, 
considering FMEAs at the conclusion of the design process is 
a mistake, since it is almost certainly too late to modify 
devices or system designs. The emphasis should be placed on 
preventing incidents and demonstrating device and system 
capabilities. The best way of preventing failures is through 
design, using logic, such as the positioning of components to 
assure proper assembly and the demonstration of functional 
margins. Equal in importance is the awareness of personnel 
concerning what the system is supposed to accomplish and how, 
by way of device and subsystem schematics, as well as system 
diagrams and assembly and checkout procedures. 
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Chapter 15 - INSTALLATION, INTEGRATION AND CHECKOUT 


o Final assurance system will accomplish the required task 
o Require end-to-end schematics/diagrams 

- Show all commands (sdftware) 

- Electrical wiring and switching 

- Required end function and location 

- Labeled interfaces 

o Simplified labeling of all components and interfaces 
o Provide detailed mockups of final functions (since flight 
pyrotechnics cannot be functioned) 
o Require end-to-end checkouts 

- Power up electrical firing circuits 

- Verify proper firing signals, related to commands 

- Verify signals reached the correct point for function 

Reference 43 


Installation, integration and checkout is not only the final 
assurance the system will accomplish the required task, it is 
the last opportunity to detect and correct any flaws in the 
hardware or software of the systems. Since pyrotechnic 
devices generally cannot be functioned during checkout of 
electrical or other firing systems, it is imperative that 
personnel are aware of what they are testing and what is 
expected to occur on any given firing command. This 
information should be included on end-to-end system 
schematics, diagrams and procedures. One drawing should 
contain sufficient information, (referring to supporting 
drawings, hardware and procedures), to allow personnel to 
trace an entire command subsystem from generation (what the 
command is supposed to look like) , through how it is 
transferred to the pyrotechnic device, and what is supposed 
to occur when the command is received. Simplified, 
standardized labeling should be continuous throughout all of 
the components of a subsystem; do not allow labeling to be 
independent among individual subsystems and designers. 
Accurate mockups (with appropriate sensors and indicators to 
acknowledge the arrival of the command) of the devices and 
subsystems into which these firing systems are to be 
installed are also valuable in assuring that the system will 
function as required and that the correct installations will 
be accomplished. That is, personnel should be able to 
understand that command A _ should be transmitted through 
electrical circuit A to fire the primary energy source, not 
just that a final connection was made. End-to-end checkouts 
should be performed on the assembled subsystems by powering 
up electrical (or other) firing circuits to verify the proper 
firing signals were generated, and related to the commands at 
the correct sequence, as well as to verify that the signals 
were correct and reached the correct point to accomplish the 
function. 
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The problem encountered, particularly by large projects, is 
the lack of ownership of the pyrotechnic hardware. That is, 
no one assumes the responsibility of assuring the success of 
the hardware in meeting the required function from design 
through the final installation and checkout. Unfortunately, 
the same personnel generally do not follow the hardware 
throughout its lifetime, and it is handed from one 
organization to another to accomplish each phase of the 
program. At each interface, the next team may assume that 
their predecessors did their job, and details in 
understanding the hardware can be lost. 
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chapter 16 - SHELF AND SERVICE LIFE EVALUATION 

o Shelf and service survivability demonstrated by performance 
o Determine/utilize key performance parameters 
o Establish a performance baseline 

- At original manufacturing cycle 

- Or use youngest available, identical units 
o Sample and function units from shelf /service 
o Compare to baseline 

o Frequency of sampling dependent on 

- Design 

- Performance 

- Criticality of function 

References 37 and 38 


The survivability of pyrotechnic devices under long-term 
shelf and service conditions should be evaluated by 
demonstrating performance before and after such exposures. 

The long-term stability of devices cannot be accurately 
predicted, nor demonstrated through accelerated aging 
techniques. Past assumptions have been made that 1) all 
reactive materials have a predictable deterioration mechanism 
to allow predictions of allowable lifetimes, and 2) elevating 
the temperature would predictably accelerate the 
deterioration . 

Key performance parameters must be determined and a baseline 
established for comparison to the performance produced by 
devices removed from the shelf or after a long time in 
service. For example, in the evaluation of rigid explosive 
transfer lines, functional measurements included the velocity 
of explosive propagation down the explosive cord, and the 
velocity and pattern of the explosively accelerated fragments 
off the end and side of the transfer cups. The purity of the 
explosive materials was evaluated, and degradation studies 
were conducted, which corroborated functional performance 
decreases with loss in chemical purity. However, for 
percussion primer-initiated devices, a chemical analysis of 
the multi-ingredient primer mix would be not only complex, 
but would be difficult to correlate to functional 
performance. Furthermore, the failure modes of percussion 
primers are contamination and displacement of the mix, due to 
mechanical inputs, such as vibration. Therefore, the 
evaluation emphasis was placed on determining functionality 
with the highly sensitive ignitability test method. 

The frequency of removing samples from service for evaluation 
depends on the design, the performance of the device and the 
criticality of its function. To use the rigid explosive 
transfer line example, the design of the line provides for 
hermetic sealing of all explosive materials, the materials 
selected were extremely pure and very stable under time and 
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temperature, and the assemblies were very rugged with the 
explosives compacted at 32,000 psi. The performance of 
transfer lines is highly reproducible, producing standard 
deviations of 1 to 5% of the mean values of performance. 
Obviously, transfer lines serve a critical function, 
initiating virtually all the escape system functions in a 
wide variety of fighter aircraft. Therefore, the original 
allowable service life was 18 months before changeout and 
further evaluation was required. However, as experience 
increased, service life was extended with the finding that 
lines removed from 9 years of service on Army helicopters 
could not be functionally or chemically differentiated from 
new lines. The Army is leaving all these lines in their 
fleet, removing a sample of units at periodic intervals for 
evaluation, and expecting no changes for the lifetime of 
their aircraft. For the Air Force's B-1B aircraft, service 
life was extended from 3 to 20 years in a single step. 
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Chapter 17 - PAST EXPERIENCE AND LESSONS LEARNED 


Two examples of past failures of completely different 
pyrotechnic devices are provided to present logic for 
evaluation and correction. 

17-1 - Failure Investigation of Vi king Pin Puller 
o Successful performance on Mars Lander 

o Planned to utilize original hardware lot, 20 years later 
o Second user had failure 

- Duplicate unit 

- Same manufacturer 

- Same design/drawings 
o Contributors to failure 

- Lack of o-ring seals 

- NSI combustion inef f iciency/guenching 

- Deformation of cylinder bore 

o After redesign, pin puller went from inadequate 

functional margin to a capability of 6 times the energy 
required to stroke 

o Confinement margin demonstrated by dual-cartridge firing 
at 200°F under vacuum 


Reference 4 


Following the successful use of the Viking Lander pin puller 
(figure 42) on the surface of the planet Mars, two other 
programs selected it for further application. A NASA Langley 
Research Center project, the Halogen Occultation Experiment 
(HALOE) , used residual Viking pin pullers. The Jet 
Propulsion Laboratory (JPL) planned to go to the manufacturer 
of these pin pullers to produce another lot, conduct a delta- 
qualification for their unique requirements, and fly it on 
the Magellan spacecraft. However, early in their evaluation 
effort, a unit only stroked half the required distance. 
Following a JPL analysis and resolution, another unit failed 
to stroke at all. This design was then abandoned by JPL and 
another previously qualified pin puller was selected and 
used. Meanwhile, NASA Langley Research Center had made a 
commitment to use this device and elected to conduct a 
failure investigation. 

As shown in figure 42, the energy sources were the Viking 
Standard Initiators (VSIs) , which are virtually identical to 
the NASA Standard Initiator (NSI) . Firing either or both 
units would accomplish the function. The outputs of the VSIs 
each pressurized a blind port, that has a 0.100-inch diameter 
orifice to vent the gas behind the piston. An 80-pound 
strength shear pin prevented premature motion. An energy 
absorbing cup was crushed by the excess energy achieved by 
the piston/pm at the end of the stroke. 

The Viking development effort relied on monitoring the peak 
pressure produced in the pin puller to obtain an 
understanding of functional margin. A transducer was 
installed in the port opposite to the VSI that was fired. It 
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Miking. PYRO OPERATED PIN PULLER - 1/4” 



Figure 42. Cross sectional view of Viking pin puller. 

was found through off-loading of the pyrotechnic charge in 
the VSI that the pin puller would function with only half the 
normal peak pressure. Accordingly, the project assumed a 
functional margin of 2, or twice the capability that was 
necessary. Furthermore, Viking never experienced a failure; 
more than 150 consecutive, successful go/no-go tests, 
including a rigorous environmental qualification program and 
a number of subsystem functional demonstrations were 
accomplished by the time the spacecraft flew. How could a 
"fully-qualified" device with such a pedigree fail to 
function 20 years later? 

The Langley failure investigation revealed that peak 
pressure, as the only test parameter, meant virtually 
nothing. It was also found that the o-ring seals were 
inadequate: (1) the chemical chromate coating (Alodine) was 
wiped from the interior of the piston bore and adhered to the 
o-ring, preventing a seal, and (2) the molybdenum 
disulfide/graphite dry lubricant was wiped from the pin and 
piled up on the upstream pressure side of the pin o-rings and 
prevented a seal. The net effect was to decrease the 
pressures achieved in the working volume, and ultimately, to 
reduce the combustion efficiency and to quench the combustion 
of the cartridge mix. The bottom of the VSI port 
occasionally deformed to grip the piston. 

The resolution was to change the pin puller's housing 
material and the dry lubricant on the pin. A steel body was 
flown, but hard-anodized aluminum performed as well under 
additional testing. The dry lubricant was an 
electrolitically deposited nickel/Tef Ion coating. The energy 
required to function the pin puller was obtained by dropping 
a small mass onto the pin; drop height, multiplied by the 
drop weight, produced a value of inch-pounds. The energy 
absorbing capability of the cup was calibrated by increasing 
the drop height. Thus, after each firing, disassembling the 
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pin puller and measuring the cup crush provided an energy 
delivery value for the cartridge. These data are summarized 
in figure 43. A value of 25 inch-pounds was determined to 
stroke the piston/pin and deform the energy absorbing cu^ to 
prevent rebound. In a sample of only 5 pin puller functional 
tests, conducted using actual spacecraft structure, the 
average value of energy delivered by the cartridge was 165 
with a standard deviation (sigma) of 22 inch-pounds. 

Assuming a normal probabilistic distribution, statistical 
tables indicated that the probability of failure for both pin 
pullers on the mission was equal to or less than 0.4%. That 
is, the probability for success of both pin pullers was equal 
to or greater than 99.6%. 


FUNCTIONAL MARGIN GRAPHIC PRESENTATION 

CHANGED FROM DETERMINISTIC TO PROBABILISTIC 



PROBABILITY OF FAILURE <* 0.4% FOR 2 PIN PULLERS (BASED ON SAMPLE OF FIVE TESTS) 


Figure 43. Statistical presentation of functional margin for 
redesigned HALOE pin puller. 


65 



17.2 - Failure Investigation of Lockheed Super*Zip Separation 
Jpjnt 

o Flew for 20 years as stage and shroud separation 
o Failure occurred in ground test at cold temperature 
o Contributors to failure 

- Structural material changed from fracture sensitive to 
fracture resistant 

- Did not adequately control thickness of structural 
material 

o Cold temperature had no effect on performance 
o Functional margin: 

- Flight explosive load 27% greater than needed 

- Capability of fracture 71% greater thickness than needed 
o Confinement margin was demonstrated by 

- Determining mechanism that caused tube rupture 

- Determined explosive load that induced tube rupture 

- Compared to flight load 

References 2 and 39 


The Lockheed Super*Zip separation joint was developed and 
qualified in the late 1960’s for payload shrouds (opening the 
shroud longitudinally and across the nose) and for payload 
release (circumferential, cylindrical severance, as shown in 
figure 44). In 1984, during a cold-temperature ground-test 
demonstration of the Shuttle/Centaur system, the joint failed 
to separate around the entire circumference. This is one of 
the worst possible failure modes, in that a partial 
separation would prevent payload release, requiring astronaut 
extravehicular activity to dump the payload. The Shuttle 
cannot land with the partially released payload on-board. 
Landing loads might cause the remainder of the joint to fail, 
dropping the payload into the cargo bay, and destroying the 
Orbiter . 

The configurations of this separation joint are shown in 
figure 45. The principle of operation is the explosive 
expansion of a flattened tube, which induces a tensile load 
in the material in the two side plates between the notched 
areas and the tube to achieve separation. The explosive 
cord, on detonating, transfers its energy through the rubber 
extrusion and into the tube. All products of the explosion 
are contained by the tube. The material that was initially 
selected to be severed was fracture-sensitive aluminum, 7075- 
T6. The first question is, "Why are the three joints 
different?" One joint (Galileo) has one explosive cord and 
two (Centaur and IUS) have two cords. Firing either one or 
both cords achieves separation, but firing both cords can 
cause tube rupture. The first joint has a reduction in 
thickness at the bolt lines in the side plates, and the other 
two do not. The first joint has a material thickness at the 
notches of 0.025 inch, while the other two have a thickness 
of 0.042 inch. Different fasteners are used. The flanges 
interfacing the two halves of the system to be separated are 
different to accommodate structural designs selected. The 
Galileo design was selected for its lighter weight. 
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Figure 44. Shuttle /Centaur deployment system, using the 
Lockheed Super* Zip separation ring. 



Figure 45. Radial cross sectional views of three types of 

Super* Zip separation joints, and the programs to 
which they were applied. 
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Parameters within this system, a portion of which are shown 
in figure 46, were evaluated, and their effects on 
functionality were quantified. It was learned that the 
fracture mechanism was the following: 1) the detonation of 
the explosive cord caused zones at the notches (ligaments) to 
be "bruised" or preweakened by damaging grain boundaries, 2) 
the expansion of the tube forced the doublers to bend, 
hinging inboard of the line of fasteners, and an explosive 
impulse on the major axis of the tube created a tensile load 
in the doubler to 3) structurally fail the ligament. The key 
point is the bending of the doubler, which is determined by 
the cube of the plate thickness. A decision was made by the 
Shuttle/ Centaur Project Office to anneal the previously 
qualified 7075-T6 aluminum to a 7075-T73 condition to avoid 
concerns about corrosion-resistant properties of the T6 
material. A short panel was made up with the T73 material, 
test-fired successfully and declared acceptable. 
Unfortunately, the functional margin of the system had been 
reduced to nearly zero. That is, an examination of the 
doublers in the failed test revealed that thicknesses to 
0.085 inch fractured successfully, and thicknesses above 
0.086 experienced separation failures! Thus, while fracture 
properties of the material was the most important variable, a 
close second was doubler thickness. The evaluation parameter 
used throughout the experimental effort to judge and compare 
performance was the doubler thickness. 



Figure 46. Identification of a portion of the parameters 
evaluated in the Super* Zip separation joint. 
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Using this doubler thickness as a performance parameter, a 
tapered doubler plate (figure 37) was machined to permit the 
evaluation of a particular variable within a length of 8 
inches. That is, as the doubler thickness increased, it 
became stiffer to resist fracture. The doubler thickness was 
varied from 0.065 to 0.123 inch to prevent total fracture 
within the limits of the variables evaluated, but allowed 
maximum severance to be measured in each firing. Figure 47 
shows the results of several variables, comparing doubler 
thickness for successful fracture to explosive load. The 
7075-T6 doubler material easily produced the highest 
performance in the dual-cord flight configuration. The top 
curve indicates that a single, on-center cord is more 
efficient than the flight configuration at explosive loads to 
just under 11 grains per foot. At 11 grains per foot, tube 
splits occurred in the dual-cord configuration, venting 
explosive products. Separate tests revealed that the tube in 
the single-cord configuration could easily withstand much 
higher explosive loads. The mechanism that produced tube 
rupture was the impact of the tube against the end ring 
nearest to the cord fired, inducing a thinning of the tube 
wall. As the tube continued to expand, it failed in tension 
at this thinned site. 



Figure 47. Severance performance, comparing web thickness to 
explosive load, of several configurations of the 
Supcr*Zip separation joint. 
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Explosive margin for this separation joint was established by 
ratioing loads: 


minimal flight load 


min. load to break thickest doubler 

9.5 

For the Shuttle/ IUS: = 1.27 

7.5 


A second margin was established by ratioing the plate bending 
moments for successful severance (plate thicknesses cubed) at 
the minimum flight load to the maximum allowable flight 
thickness. 

(minimum severed thickness) 3 
(maximum allowable thickness) 3 

(0. 098) 3 

For the Shuttle/ IUS: - = 1.71 

( 0 . 082 ) 3 
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chapter 18 - DISPOSAL METHODS 

o Environmental restrictions 

- Burning to atmospheric discharge 

- Burial in land fills 

- Discharge into streams/water 

o Biggest Military problem ■* base cleanup/weapons disposal 
o Government approach 

- Closed-cycle burning, minimal discharge 

- Chemically dissolving^separation/recycling 

o U.S. Army Defense Ammunition Center and School 
Savanna, Illinois 61074-9639 
(815) 273-8901 
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CONCLUSIONS/RECOMMENDATIONS 

Applying pyrotechnic (explosive and propellant-actuated) 
devices has been considered to be an art, rather than an 
engineering science. When failures occurred after completing 
qualification, past designers had few test methods that 
quantitatively defined performance and functional and 
structural containment margins. Their recourse was limited, 
other than to provide more pyrotechnic energy. However, if 
this scenario was true, why has the application of 
pyrotechnics been so successful? What is the need for change 
if so few failures have occurred? Finally, with the failures 
that have occurred, why haven't clear resolutions been made 
and specifications improved to prevent recurrence? 

Over the years a number of justifications have been offered. 
Pyrotechnic devices contain explosives, which really can't be 
measured because of their high energy levels and dynamics. 
These devices are just like electronic "black boxes;" it is 
not necessary to understand the internal components. This is 
the way we've always tested these devices. These people know 
what they're doing; they have been making and applying these 
devices for a lot of years. Besides, the devices we're using 
now are just like the designs that have been flying for 
years. We don't have time to do research. We have to fix 
this failure quickly to meet flight schedules. Don't worry, 
once we get this system together, it'll work. Trust me. 

Success with pyrotechnic devices has been achieved through 
large functional margins. Even though functional margins 
were not defined, it is not difficult to use plenty of 
explosive or propellant to make each device work. The major 
problem with widely cited requirements (go/no-go testing and 
+/-15% pyrotechnic loads) is that functional or containment 
margins are not defined. Without failures there is no way to 
determine how close the device is to failure. That is, when 
the device has a minimal energy source, if all the devices 
within a group (usually numbering less than 200) function, 
the assumption is made that functional reliability is 
adequate. However, should system parameters vary in an 
amount that would be trivial in pneumatics or hydraulics 
systems, such as surface finish, o-ring lubrication or the 
initial free volume into which the energy source is fired, 
failure can occur. Similarly, when the device has too large 
a charge, which could introduce structural failure, the 
assumption is made that since all test units maintained 
structural integrity containment reliability has been 
achieved. More than 2000 "identical" devices must be 
subjected to simple go/no-go testing to assure functional and 
structural reliability. 

The primary purpose of this manual is to alter the concept 
that the use of pyrotechnics is an art and refute the above- 
stated "justifications" that applications don't need to be 
understood by providing information on pyrotechnic design, 
development and qualification on an engineering basis. 
Included are approaches to demonstrate functional reliability 
with less than 10 units, how to manage pyrotechnic-unique 
requirements, and methods to assure that the system is 
properly assembled and will perform the required tasks. 
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